Buggy code:
mEFli [ ( i + 1 ) ] = 'n' ; break ; case 2 : mEFli [ i ] = 'f' ; mEFli [ ( i + 1 ) ] = 'r' ; break ; case 3 : mEFli [ i ] = 'e' ; mEFli [ ( i + 1 ) ] = 's' ; break ; case 4 : mEFli [ i ] = 'j' ; mEFli [ ( i + 1 ) ] = 'a' ; break ; case 5 : mEFli [ i ] = 'k' ; mEFli [ ( i + 1 ) ] = 'o' ; break ; case 6 : mEFli [ i ] = 'z' ; mEFli [ ( i + 1 ) ] = 'h' ; break ; case 7 : mEFli [ i ] = 'h' ; mEFli [ ( i + 1 ) ] = 'e' ; break ; default : mEFli [ i ] = '<seq2seq4repair_space>' ; mEFli [ ( i + 1 ) ] = '<seq2seq4repair_space>' ; } } if ( DBG ) log ( ( "EF_LI=" + ( IccUtils . bytesToHexString ( mEFli ) ) ) ) ; } } private class EfCsimSpnLoaded implements IccRecordLoaded { @ Override public String getEfName ( ) { } @ Override public void onRecordLoaded ( AsyncResult ar ) { byte [ ] data = ( ( byte [ ] ) ( ar . result ) ) ; if ( DBG ) log ( ( "CSIM_SPN=" + ( IccUtils . bytesToHexString ( data ) ) ) ) ; mCsimSpnDisplayCondition = ( 1 & ( data [ 0 ] ) ) != 0 ; int encoding = data [ 1 ] ; int language = data [ 2 ] ; byte [ ] spnData = new byte [ 32 ] ; int len = ( ( ( data . length ) - 3 ) < 32 ) ? ( data . length ) - 3 : 32 ; System . arraycopy ( data , 3 , spnData , 0 , len ) ; int numBytes ; for ( numBytes = 0 ; numBytes < ( spnData . length ) ; numBytes ++ ) { if ( ( ( spnData [ numBytes ] ) & 255 ) == 255 ) break ; } if ( numBytes == 0 ) { setServiceProviderName ( "" ) ; return ; } try { switch ( encoding ) { case UserData . ENCODING_OCTET : case UserData . ENCODING_LATIN : setServiceProviderName ( new String ( spnData , 0 , numBytes , "ISO-8859-1" ) ) ; break ; case UserData . ENCODING_IA5 : case UserData . ENCODING_GSM_7BIT_ALPHABET : setServiceProviderName ( GsmAlphabet . gsm7BitPackedToString ( spnData , 0 , ( ( numBytes * 8 ) // 7 ) ) ) ; break ; case UserData . ENCODING_7BIT_ASCII : String spn = new String ( spnData , 0 , numBytes , "US-ASCII" ) ; if ( TextUtils . isPrintableAsciiOnly ( spn ) ) { setServiceProviderName ( spn ) ; } else { if ( DBG ) log ( ( "Some<seq2seq4repair_space>corruption<seq2seq4repair_space>in<seq2seq4repair_space>SPN<seq2seq4repair_space>decoding<seq2seq4repair_space>=<seq2seq4repair_space>" + spn ) ) ; if ( DBG ) log ( "Using<seq2seq4repair_space>ENCODING_GSM_7BIT_ALPHABET<seq2seq4repair_space>scheme..." ) ; setServiceProviderName ( GsmAlphabet . gsm7BitPackedToString ( spnData , 0 , ( ( numBytes * 8 ) // 7 ) ) ) ; } break ; case UserData . ENCODING_UNICODE_16 : setServiceProviderName ( new String ( spnData , 0 , numBytes , "utf-16" ) ) ; break ; default : log ( "SPN<seq2seq4repair_space>encoding<seq2seq4repair_space>not<seq2seq4repair_space>supported" ) ; } } catch ( Exception e ) { log ( ( "spn<seq2seq4repair_space>decode<seq2seq4repair_space>error:<seq2seq4repair_space>" + e ) ) ; } if ( DBG ) log ( ( "spn=" + ( getServiceProviderName ( ) ) ) ) ; if ( DBG ) log ( ( "spnCondition=" + ( mCsimSpnDisplayCondition ) ) ) ; <START_BUG> SystemProperties . set ( TelephonyProperties . PROPERTY_ICC_OPERATOR_ALPHA , getServiceProviderName ( ) ) ; <END_BUG> } } private class EfCsimMdnLoaded implements IccRecordLoaded { @ Override public String getEfName ( ) { } @ Override public void onRecordLoaded ( AsyncResult ar ) { byte [ ] data = ( ( byte [ ] ) ( ar . result ) ) ; if ( DBG ) log ( ( "CSIM_MDN=" + ( IccUtils . bytesToHexString ( data ) ) ) ) ; int mdnDigitsNum = 15 & ( data [ 0 ] ) ; mMdn = IccUtils . cdmaBcdToString ( data , 1 , mdnDigitsNum ) ; if ( DBG ) log ( ( "CSIM<seq2seq4repair_space>MDN=" + ( mMdn ) ) ) ; } } private class EfCsimImsimLoaded implements IccRecordLoaded { @ Override public String getEfName ( ) { } @ Override public void onRecordLoaded ( AsyncResult ar ) { byte [ ] data = ( ( byte [ ] ) ( ar . result ) ) ; if ( ( data == null ) || ( ( data . length ) < 10 ) ) { log ( ( "Invalid<seq2seq4repair_space>IMSI<seq2seq4repair_space>from<seq2seq4repair_space>EF_CSIM_IMSIM<seq2seq4repair_space>" + ( IccUtils . bytesToHexString ( data ) ) ) ) ; mImsi = null ; mMin = null ; return ; } if ( DBG ) log ( ( "CSIM_IMSIM=" + ( IccUtils . bytesToHexString ( data ) ) ) ) ; boolean provisioned = ( ( data [ 7 ] ) & 128 ) == 128 ; if ( provisioned ) { mImsi = decodeImsi ( data ) ; if ( null != ( mImsi ) ) { mMin = mImsi . substring ( 5 , 15 ) ; } log ( ( ( "IMSI:<seq2seq4repair_space>" + ( mImsi . substring ( 0 , 5 ) ) ) + "xxxxxxxxx" ) ) ; } else { if ( DBG ) log ( "IMSI<seq2seq4repair_space>not<seq2seq4repair_space>provisioned<seq2seq4repair_space>in<seq2seq4repair_space>card" ) ; } String operatorNumeric = getOperatorNumeric ( ) ; if ( operatorNumeric != null ) { if ( ( operatorNumeric . length ( ) ) <= 6 ) { MccTable . updateMccMncConfiguration ( mContext , operatorNumeric , false ) ; } } mImsiReadyRegistrants . notifyRegistrants ( ) ; } }

Fix:
setSystemProperty ( TelephonyProperties . PROPERTY_ICC_OPERATOR_ALPHA , getServiceProviderName ( ) ) ;